CYBER

Agencies must speed up preparation for Internet of Things security

Editor's Note: This article originally appeared on FCW.com

Government agencies tasked with regulatory and security responsibilities are running out of time to address security challenges associated with the increased connectivity of the Internet of Things, according to Department of Homeland Security Assistant Secretary for Cyber Policy Robert Silvers.

Increased connectivity for devices means expanded attack surfaces. The challenge, Silvers said at an Aug. 31 National Institute of Standards and Technology meeting, is developing flexible, living security standards while preserving the innovation and productivity gains that come with increased internet.

"I think we all recognize the IoT is not a trend, it's a full-blown phenomenon at this point," he said. "We have, as against that enormous security challenge, a very narrow and closing window in which to address the security challenges on the front end before we are put in the much more difficult, much less enviable position of addressing security against an ecosystem that is already stood up, functioning and created."

Trying to bolt on security measures after the widespread proliferation of connected devices "is suboptimal… if not impossible, is more expensive and is less effective than doing it right to start," he said.

Silvers also lamented the current lack of "anything resembling a standard of due care" for when things "really go awry and ultimately hit the court system" in cases that may negatively impact consumers.

"I think we need just to be very candid with ourselves, with each other, that we see few solutions gaining traction in any kind of holistic and sustained and widespread way," he said.  "The bottom line is that product is moving to market without security" plans for either the short or long term, he said.

Silvers acknowledged that there are "very good efforts" in the public and private sectors to protect IoT stakeholders, such as NIST's IoT building blocks and the Defense Department's investment in IoT security.

However, he also emphasized that government agencies, including DHS, "need to work a lot harder" on the IoT security front.  "We need to accelerate everything we're doing," he said. "We need to make tough decisions now because they're not going to get easier."

For long-term solutions, Silvers said he was unsure of the best answer, but suggested a system of certification like the Energy Star seal of approval for home appliances as a potential avenue.

"In the meantime, we need to have bridge solutions," he said.

Silvers also announced that although DHS is not a regulatory agency, it is planning to issue strategic principles for IOT stakeholders, including best practices and guidance for risk-based decisions that draw from previous work of private partners and other agencies.

He said the principles will not be overly prescriptive or controversial, but that "it's time" for agencies to begin to address their security responsibilities.

About the Author

Chase Gunter is a staff writer covering civilian agencies, workforce issues, health IT, open data and innovation.

Prior to joining FCW, Gunter reported for the C-Ville Weekly in Charlottesville, Va., and served as a college sports beat writer for the South Boston (Va.) News and Record. He started at FCW as an editorial fellow before joining the team full-time as a reporter.

Gunter is a graduate of the University of Virginia, where his emphases were English, history and media studies.

Click here for previous articles by Gunter, or connect with him on Twitter: @WChaseGunter

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here
close

Trending

  • Dive into our Contract Award database

    In an exclusive for WT Insider members, we are collecting all of the contract awards we cover into a database that you can sort by contractor, agency, value and other parameters. You can also download it into a spreadsheet. Our databases track awards back to 2013. Read More

  • Navigating the trends and issues of 2016 Nick Wakeman

    In our latest WT Insider Report, we pull together our best advice, insights and reporting on the trends and issues that will shape the market in 2016 and beyond. Read More

contracts DB

Washington Technology Daily

Sign up for our newsletter.

I agree to this site's Privacy Policy.